The Agent Skills Directory

[METADATA_POISONING]: Misleading skill metadata.
The skill claims to be an 'official' source from the expo/skills repository in its YAML frontmatter, despite being authored by a third-party user ('sickn33').
The scripts/package.json file uses the name @expo/cicd-workflows-skill, which further imitates official organization naming conventions.
[COMMAND_EXECUTION]: Local script execution and environment modification.
The skill instructs the agent to run npm install and execute provided Node.js scripts (fetch.js, validate.js).
The scripts utilize import.meta.main, which is not standard in many Node.js environments, potentially leading to broken behavior or unexpected execution paths.
[DATA_EXFILTRATION]: Unconstrained network access utility.
The scripts/fetch.js script is an unconstrained utility that allows fetching arbitrary URLs without domain or protocol restrictions.
While intended for official documentation, the tool provides a mechanism for the agent to potentially transmit data to any external endpoint.
[INDIRECT_PROMPT_INJECTION]: Processing of untrusted external and local data.
Ingestion points: scripts/fetch.js fetches content from URLs; scripts/validate.js reads local .yml files.
Boundary markers: None. No delimiters or warnings are used when processing external or user-provided content.
Capability inventory: Subprocess execution (node, npm), file system operations (read/write in fetch.js), and network operations.
Sanitization: Content is validated for structure but not for malicious natural language instructions.

expo-cicd-workflows